Verifying apk on the device

rocky-planet

here's afunny little loop I can't get out of:

I want to install Obtanium on a new device (tablet).
I can download the apk and sig, sha, etc files from Github via Vanadium
I can't verify the apk without apps (recommended here)
For those apps, I need to verify signatures...
I've been told/read not to use F-Droid.

Help.

SerenityNow

You can download App Verifier via Accrescent Store first. It is in the Graphene App Store.

missing-root

SerenityNow

True.

You install GrapheneOS, which includes the save "Apps" store
That installs Accrescent, which is also verified
Accrescent then has measurements to remove the need to trust the first install of an app. It can also work with AppVerifier so you can compare the checksum

SerenityNow

Also, after the installation I deactivated Accrescent as I don't use any apps from there, and added the GitHub source of App verifier in Obtainium and keep it updated from there. (Not sure if it accepts two different sources in this case though, it didn't try to update so far).

rocky-planet

Ah, thank you both.